hxxps://cdn[.]discordapp[.]com/attachments/1231156668004438049/1231250890032414740/main[.]exe?ex=662674bf&is=6625233f&hm=f17a6cfc348cf40332ed952c978d72a639559907ed90cd4a46c391b6aa036bfc&

Analysis

max time kernel
600s
max time network
601s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
21/04/2024, 16:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1231156668004438049/1231250890032414740/main.exe?ex=662674bf&is=6625233f&hm=f17a6cfc348cf40332ed952c978d72a639559907ed90cd4a46c391b6aa036bfc&

Score

8^/10

discovery evasion persistence trojan

Malware Config

Signatures

Downloads MZ/PE file

Sets file execution options in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Executes dropped EXE 46 IoCs

pid	Process
4920	main.exe
3700	main.exe
2636	main.exe
2920	main.exe
2324	main.exe
3232	main.exe
388	main.exe
236	main.exe
952	main.exe
1520	main.exe
1596	main.exe
4408	main.exe
2432	main.exe
4860	main.exe
1992	RobloxPlayerInstaller.exe
1096	main.exe
4372	MicrosoftEdgeWebview2Setup.exe
2256	MicrosoftEdgeUpdate.exe
372	MicrosoftEdgeUpdate.exe
1344	MicrosoftEdgeUpdate.exe
876	MicrosoftEdgeUpdateComRegisterShell64.exe
396	MicrosoftEdgeUpdateComRegisterShell64.exe
2920	MicrosoftEdgeUpdateComRegisterShell64.exe
2432	MicrosoftEdgeUpdate.exe
4460	MicrosoftEdgeUpdate.exe
3608	MicrosoftEdgeUpdate.exe
3620	MicrosoftEdgeUpdate.exe
5508	main.exe
5672	main.exe
5684	main.exe
5896	main.exe
5948	main.exe
6124	main.exe
6116	main.exe
5216	main.exe
5380	main.exe
3308	main.exe
5460	main.exe
5480	main.exe
5592	main.exe
6088	MicrosoftEdge_X64_124.0.2478.51.exe
4356	setup.exe
5244	setup.exe
4928	main.exe
6084	MicrosoftEdgeUpdate.exe
5548	RobloxPlayerBeta.exe

Loads dropped DLL 64 IoCs

pid	Process
3700	main.exe
3700	main.exe
3700	main.exe
3700	main.exe
3700	main.exe
3700	main.exe
3700	main.exe
3700	main.exe
3700	main.exe
3700	main.exe
2920	main.exe
2920	main.exe
2920	main.exe
2920	main.exe
2920	main.exe
2920	main.exe
2920	main.exe
2920	main.exe
2920	main.exe
2920	main.exe
2920	main.exe
388	main.exe
388	main.exe
388	main.exe
388	main.exe
388	main.exe
388	main.exe
388	main.exe
388	main.exe
388	main.exe
388	main.exe
388	main.exe
236	main.exe
236	main.exe
236	main.exe
236	main.exe
236	main.exe
236	main.exe
236	main.exe
236	main.exe
236	main.exe
236	main.exe
1596	main.exe
1596	main.exe
1596	main.exe
1596	main.exe
1596	main.exe
4408	main.exe
1596	main.exe
4408	main.exe
1596	main.exe
1596	main.exe
1596	main.exe
1596	main.exe
1596	main.exe
4408	main.exe
4408	main.exe
4408	main.exe
4408	main.exe
4408	main.exe
4408	main.exe
4408	main.exe
4408	main.exe
4408	main.exe

Registers COM server for autorun 1 TTPs 31 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Checks system information in the registry 2 TTPs 10 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	MicrosoftEdgeUpdate.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
5548	RobloxPlayerBeta.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 18 IoCs

pid	Process
5548	RobloxPlayerBeta.exe
5548	RobloxPlayerBeta.exe
5548	RobloxPlayerBeta.exe
5548	RobloxPlayerBeta.exe
5548	RobloxPlayerBeta.exe
5548	RobloxPlayerBeta.exe
5548	RobloxPlayerBeta.exe
5548	RobloxPlayerBeta.exe
5548	RobloxPlayerBeta.exe
5548	RobloxPlayerBeta.exe
5548	RobloxPlayerBeta.exe
5548	RobloxPlayerBeta.exe
5548	RobloxPlayerBeta.exe
5548	RobloxPlayerBeta.exe
5548	RobloxPlayerBeta.exe
5548	RobloxPlayerBeta.exe
5548	RobloxPlayerBeta.exe
5548	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\RobloxCrashHandler.exe	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\ui\LegacyRbxGui\GravelSide.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\124.0.2478.51\Trust Protection Lists\Sigma\Social	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\AnimationEditor\eventMarker_border.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\CompositorDebugger\pause.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\PlatformContent\pc\textures\water\normal_20.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90A5.tmp\msedgeupdateres_km.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\124.0.2478.51\Locales\et.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\124.0.2478.51\Locales\lo.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\avatar\defaultPants.rbxm	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\124.0.2478.51\Locales\mi.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\particles\fire_sparks_main.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\ui\NetworkPause\no connection.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\124.0.2478.51\Locales\kn.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\fonts\families\PermanentMarker.json	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\ui\PlayerList\UnFriend.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\ui\Settings\Slider\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\PlatformContent\pc\textures\grass\normal.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\124.0.2478.51\Locales\gd.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\ui\common\robux_color.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\ui\PlayerList\Block.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\TagEditor\Visibility.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\fonts\PressStart2P-Regular.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\particles\explosion01_shockwave_main.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\ui\Chat\VRChatBackground.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\avatar\compositing\CompositLeftLegBase.mesh	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\TerrainTools\radio_button_bullet.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\TerrainTools\radio_button_bullet_dark.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\ExtraContent\textures\ui\LuaApp\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90A5.tmp\msedgeupdateres_fr.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\AnimationEditor\img_dark_scrubberhead.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\ui\Emotes\Editor\TenFoot\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\ui\Emotes\Small\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\ui\PlayerList\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\ui\VoiceChat\SpeakerLight\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\PlatformContent\pc\textures\water\normal_16.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\AnimationEditor\image_scrollbar_vertical_top.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\AvatarEditorImages\gr-selection-border.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\ui\InspectMenu\selection_regular.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\PlatformContent\pc\terrain\diffusearray.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\fonts\Arimo-Bold.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\StudioToolbox\AssetPreview\star_filled.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\ui\VoiceChat\Misc\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\localizationUIScrapingOn.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\ExtraContent\textures\ui\Controls\DesignSystem\ButtonR1.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\ExtraContent\textures\ui\LuaChat\graphic\gr-profile-border-48x48-dotted.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\124.0.2478.51\msedgewebview2.exe.sig	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\AnimationEditor\menu_shadow_bottom.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\9SliceEditor\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\PlatformContent\pc\textures\slate\diffuse.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU90A5.tmp\msedgeupdateres_af.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\124.0.2478.51\copilot_provider_msix\package_metadata	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\124.0.2478.51\Locales\ne.pak	setup.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\AnimationEditor\ic-checkbox-active.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\R15Migrator\Icon_AdapterPaneTab.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\TagEditor\Compose.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\ui\InspectMenu\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\content\textures\ui\PlayerList\[email protected]	RobloxPlayerInstaller.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\4272278488\2581520266.pri	SecHealthUI.exe
File created	C:\Windows\rescache\_merged\4272278488\2581520266.pri	SecHealthUI.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	chrome.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MicrosoftEdgeUpdate.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133581889906364257"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeUpdate.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NumMethods\ = "12"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods\ = "12"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.ProcessLauncher\ = "Microsoft Edge Update Process Launcher Class"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreMachineClass.1\CLSID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\ProgID	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ = "IAppWeb"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7FDE1A1E-8B31-49A5-93B8-6BE14CFA4943}\Mode = "8"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\ = "Google Update Policy Status Class"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\NumMethods\ = "23"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachine\CLSID	MicrosoftEdgeUpdate.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\NumMethods\ = "43"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachine\ = "Microsoft Edge Update Broker Class Factory"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ = "IGoogleUpdate3WebSecurity"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ = "IAppCommand2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback.1.0\CLSID\ = "{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachine\CurVer\ = "MicrosoftEdgeUpdate.Update3WebMachine.1.0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\Elevation	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\ = "Update3COMClass"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\NumMethods\ = "16"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ = "IAppVersionWeb"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ = "IJobObserver"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\ProgID\ = "MicrosoftEdgeUpdate.Update3COMClassService.1.0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\Elevation\IconReference = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\msedgeupdate.dll,-1004"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachine\CLSID\ = "{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ = "IAppCommand"	MicrosoftEdgeUpdateComRegisterShell64.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1396	chrome.exe
1396	chrome.exe
792	chrome.exe
792	chrome.exe
1992	RobloxPlayerInstaller.exe
1992	RobloxPlayerInstaller.exe
2256	MicrosoftEdgeUpdate.exe
2256	MicrosoftEdgeUpdate.exe
2256	MicrosoftEdgeUpdate.exe
2256	MicrosoftEdgeUpdate.exe
2256	MicrosoftEdgeUpdate.exe
2256	MicrosoftEdgeUpdate.exe
5548	RobloxPlayerBeta.exe
5548	RobloxPlayerBeta.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1856	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe

Suspicious use of FindShellTrayWindow 48 IoCs

pid	Process
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
5136	SecHealthUI.exe
5804	SecHealthUI.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
5548	RobloxPlayerBeta.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 3324	1396	chrome.exe	74
PID 1396 wrote to memory of 3324	1396	chrome.exe	74
PID 1396 wrote to memory of 1240	1396	chrome.exe	76
PID 1396 wrote to memory of 1240	1396	chrome.exe	76
PID 1396 wrote to memory of 1240	1396	chrome.exe	76
PID 1396 wrote to memory of 1240	1396	chrome.exe	76
PID 1396 wrote to memory of 1240	1396	chrome.exe	76
PID 1396 wrote to memory of 1240	1396	chrome.exe	76
PID 1396 wrote to memory of 1240	1396	chrome.exe	76
PID 1396 wrote to memory of 1240	1396	chrome.exe	76
PID 1396 wrote to memory of 1240	1396	chrome.exe	76
PID 1396 wrote to memory of 1240	1396	chrome.exe	76
PID 1396 wrote to memory of 1240	1396	chrome.exe	76
PID 1396 wrote to memory of 1240	1396	chrome.exe	76
PID 1396 wrote to memory of 1240	1396	chrome.exe	76
PID 1396 wrote to memory of 1240	1396	chrome.exe	76
PID 1396 wrote to memory of 1240	1396	chrome.exe	76
PID 1396 wrote to memory of 1240	1396	chrome.exe	76
PID 1396 wrote to memory of 1240	1396	chrome.exe	76
PID 1396 wrote to memory of 1240	1396	chrome.exe	76
PID 1396 wrote to memory of 1240	1396	chrome.exe	76
PID 1396 wrote to memory of 1240	1396	chrome.exe	76
PID 1396 wrote to memory of 1240	1396	chrome.exe	76
PID 1396 wrote to memory of 1240	1396	chrome.exe	76
PID 1396 wrote to memory of 1240	1396	chrome.exe	76
PID 1396 wrote to memory of 1240	1396	chrome.exe	76
PID 1396 wrote to memory of 1240	1396	chrome.exe	76
PID 1396 wrote to memory of 1240	1396	chrome.exe	76
PID 1396 wrote to memory of 1240	1396	chrome.exe	76
PID 1396 wrote to memory of 1240	1396	chrome.exe	76
PID 1396 wrote to memory of 1240	1396	chrome.exe	76
PID 1396 wrote to memory of 1240	1396	chrome.exe	76
PID 1396 wrote to memory of 1240	1396	chrome.exe	76
PID 1396 wrote to memory of 1240	1396	chrome.exe	76
PID 1396 wrote to memory of 1240	1396	chrome.exe	76
PID 1396 wrote to memory of 1240	1396	chrome.exe	76
PID 1396 wrote to memory of 1240	1396	chrome.exe	76
PID 1396 wrote to memory of 1240	1396	chrome.exe	76
PID 1396 wrote to memory of 1240	1396	chrome.exe	76
PID 1396 wrote to memory of 1240	1396	chrome.exe	76
PID 1396 wrote to memory of 3740	1396	chrome.exe	77
PID 1396 wrote to memory of 3740	1396	chrome.exe	77
PID 1396 wrote to memory of 4852	1396	chrome.exe	78
PID 1396 wrote to memory of 4852	1396	chrome.exe	78
PID 1396 wrote to memory of 4852	1396	chrome.exe	78
PID 1396 wrote to memory of 4852	1396	chrome.exe	78
PID 1396 wrote to memory of 4852	1396	chrome.exe	78
PID 1396 wrote to memory of 4852	1396	chrome.exe	78
PID 1396 wrote to memory of 4852	1396	chrome.exe	78
PID 1396 wrote to memory of 4852	1396	chrome.exe	78
PID 1396 wrote to memory of 4852	1396	chrome.exe	78
PID 1396 wrote to memory of 4852	1396	chrome.exe	78
PID 1396 wrote to memory of 4852	1396	chrome.exe	78
PID 1396 wrote to memory of 4852	1396	chrome.exe	78
PID 1396 wrote to memory of 4852	1396	chrome.exe	78
PID 1396 wrote to memory of 4852	1396	chrome.exe	78
PID 1396 wrote to memory of 4852	1396	chrome.exe	78
PID 1396 wrote to memory of 4852	1396	chrome.exe	78
PID 1396 wrote to memory of 4852	1396	chrome.exe	78
PID 1396 wrote to memory of 4852	1396	chrome.exe	78
PID 1396 wrote to memory of 4852	1396	chrome.exe	78
PID 1396 wrote to memory of 4852	1396	chrome.exe	78
PID 1396 wrote to memory of 4852	1396	chrome.exe	78
PID 1396 wrote to memory of 4852	1396	chrome.exe	78

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1231156668004438049/1231250890032414740/main.exe?ex=662674bf&is=6625233f&hm=f17a6cfc348cf40332ed952c978d72a639559907ed90cd4a46c391b6aa036bfc&
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff8a60e9758,0x7ff8a60e9768,0x7ff8a60e9778
  2⤵
  PID:3324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1516 --field-trial-handle=1780,i,3451384898439752082,5779873312562182074,131072 /prefetch:2
  2⤵
  PID:1240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1952 --field-trial-handle=1780,i,3451384898439752082,5779873312562182074,131072 /prefetch:8
  2⤵
  PID:3740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2116 --field-trial-handle=1780,i,3451384898439752082,5779873312562182074,131072 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2960 --field-trial-handle=1780,i,3451384898439752082,5779873312562182074,131072 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2992 --field-trial-handle=1780,i,3451384898439752082,5779873312562182074,131072 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 --field-trial-handle=1780,i,3451384898439752082,5779873312562182074,131072 /prefetch:8
  2⤵
  PID:4144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5344 --field-trial-handle=1780,i,3451384898439752082,5779873312562182074,131072 /prefetch:8
  2⤵
  PID:4920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5388 --field-trial-handle=1780,i,3451384898439752082,5779873312562182074,131072 /prefetch:8
  2⤵
  PID:4028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5628 --field-trial-handle=1780,i,3451384898439752082,5779873312562182074,131072 /prefetch:8
  2⤵
  PID:4552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1576 --field-trial-handle=1780,i,3451384898439752082,5779873312562182074,131072 /prefetch:8
  2⤵
  PID:420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4600 --field-trial-handle=1780,i,3451384898439752082,5779873312562182074,131072 /prefetch:8
  2⤵
  PID:4744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2036 --field-trial-handle=1780,i,3451384898439752082,5779873312562182074,131072 /prefetch:8
  2⤵
  PID:4108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5456 --field-trial-handle=1780,i,3451384898439752082,5779873312562182074,131072 /prefetch:8
  2⤵
  PID:2408
- C:\Users\Admin\Downloads\main.exe
  "C:\Users\Admin\Downloads\main.exe"
  2⤵
  - Executes dropped EXE
  PID:4920
- - C:\Users\Admin\AppData\Local\Temp\onefile_4920_133581890911106681\main.exe
    "C:\Users\Admin\Downloads\main.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5388 --field-trial-handle=1780,i,3451384898439752082,5779873312562182074,131072 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3576 --field-trial-handle=1780,i,3451384898439752082,5779873312562182074,131072 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2992 --field-trial-handle=1780,i,3451384898439752082,5779873312562182074,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=3084 --field-trial-handle=1780,i,3451384898439752082,5779873312562182074,131072 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2060 --field-trial-handle=1780,i,3451384898439752082,5779873312562182074,131072 /prefetch:8
  2⤵
  PID:2916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4528 --field-trial-handle=1780,i,3451384898439752082,5779873312562182074,131072 /prefetch:8
  2⤵
  PID:1660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5864 --field-trial-handle=1780,i,3451384898439752082,5779873312562182074,131072 /prefetch:8
  2⤵
  PID:4448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=5836 --field-trial-handle=1780,i,3451384898439752082,5779873312562182074,131072 /prefetch:1
  2⤵
  PID:4832
- C:\Users\Admin\Downloads\main.exe
  "C:\Users\Admin\Downloads\main.exe"
  2⤵
  - Executes dropped EXE
  PID:2636
- - C:\Users\Admin\AppData\Local\Temp\onefile_2636_133581891415604767\main.exe
    "C:\Users\Admin\Downloads\main.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2920
- C:\Users\Admin\Downloads\main.exe
  "C:\Users\Admin\Downloads\main.exe"
  2⤵
  - Executes dropped EXE
  PID:2324
- - C:\Users\Admin\AppData\Local\Temp\onefile_2324_133581891438747942\main.exe
    "C:\Users\Admin\Downloads\main.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:388
- C:\Users\Admin\Downloads\main.exe
  "C:\Users\Admin\Downloads\main.exe"
  2⤵
  - Executes dropped EXE
  PID:3232
- - C:\Users\Admin\AppData\Local\Temp\onefile_3232_133581891440651540\main.exe
    "C:\Users\Admin\Downloads\main.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:236
- C:\Users\Admin\Downloads\main.exe
  "C:\Users\Admin\Downloads\main.exe"
  2⤵
  - Executes dropped EXE
  PID:952
- - C:\Users\Admin\AppData\Local\Temp\onefile_952_133581891442641679\main.exe
    "C:\Users\Admin\Downloads\main.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1596
- C:\Users\Admin\Downloads\main.exe
  "C:\Users\Admin\Downloads\main.exe"
  2⤵
  - Executes dropped EXE
  PID:1520
- - C:\Users\Admin\AppData\Local\Temp\onefile_1520_133581891444475361\main.exe
    "C:\Users\Admin\Downloads\main.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=4592 --field-trial-handle=1780,i,3451384898439752082,5779873312562182074,131072 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=3936 --field-trial-handle=1780,i,3451384898439752082,5779873312562182074,131072 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=5316 --field-trial-handle=1780,i,3451384898439752082,5779873312562182074,131072 /prefetch:1
  2⤵
  PID:440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=6088 --field-trial-handle=1780,i,3451384898439752082,5779873312562182074,131072 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=6040 --field-trial-handle=1780,i,3451384898439752082,5779873312562182074,131072 /prefetch:1
  2⤵
  PID:2460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6468 --field-trial-handle=1780,i,3451384898439752082,5779873312562182074,131072 /prefetch:8
  2⤵
  PID:4848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6572 --field-trial-handle=1780,i,3451384898439752082,5779873312562182074,131072 /prefetch:8
  2⤵
  PID:4356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=6760 --field-trial-handle=1780,i,3451384898439752082,5779873312562182074,131072 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=6968 --field-trial-handle=1780,i,3451384898439752082,5779873312562182074,131072 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7148 --field-trial-handle=1780,i,3451384898439752082,5779873312562182074,131072 /prefetch:8
  2⤵
  PID:1096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6068 --field-trial-handle=1780,i,3451384898439752082,5779873312562182074,131072 /prefetch:8
  2⤵
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:1856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --mojo-platform-channel-handle=3156 --field-trial-handle=1780,i,3451384898439752082,5779873312562182074,131072 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --mojo-platform-channel-handle=7028 --field-trial-handle=1780,i,3451384898439752082,5779873312562182074,131072 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --mojo-platform-channel-handle=6300 --field-trial-handle=1780,i,3451384898439752082,5779873312562182074,131072 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --mojo-platform-channel-handle=4560 --field-trial-handle=1780,i,3451384898439752082,5779873312562182074,131072 /prefetch:1
  2⤵
  PID:3652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --mojo-platform-channel-handle=5332 --field-trial-handle=1780,i,3451384898439752082,5779873312562182074,131072 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --mojo-platform-channel-handle=6268 --field-trial-handle=1780,i,3451384898439752082,5779873312562182074,131072 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --mojo-platform-channel-handle=6500 --field-trial-handle=1780,i,3451384898439752082,5779873312562182074,131072 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --mojo-platform-channel-handle=1524 --field-trial-handle=1780,i,3451384898439752082,5779873312562182074,131072 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --mojo-platform-channel-handle=8020 --field-trial-handle=1780,i,3451384898439752082,5779873312562182074,131072 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --mojo-platform-channel-handle=7520 --field-trial-handle=1780,i,3451384898439752082,5779873312562182074,131072 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --mojo-platform-channel-handle=7388 --field-trial-handle=1780,i,3451384898439752082,5779873312562182074,131072 /prefetch:1
  2⤵
  PID:360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7808 --field-trial-handle=1780,i,3451384898439752082,5779873312562182074,131072 /prefetch:8
  2⤵
  PID:60
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7788 --field-trial-handle=1780,i,3451384898439752082,5779873312562182074,131072 /prefetch:8
  2⤵
  PID:3088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7976 --field-trial-handle=1780,i,3451384898439752082,5779873312562182074,131072 /prefetch:8
  2⤵
  PID:4356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7740 --field-trial-handle=1780,i,3451384898439752082,5779873312562182074,131072 /prefetch:8
  2⤵
  PID:1632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7664 --field-trial-handle=1780,i,3451384898439752082,5779873312562182074,131072 /prefetch:8
  2⤵
  PID:2488
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1992
- - C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
    MicrosoftEdgeWebview2Setup.exe /silent /install
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:4372
  - - C:\Program Files (x86)\Microsoft\Temp\EU90A5.tmp\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\Temp\EU90A5.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
      4⤵
      Sets file execution options in registry
      Executes dropped EXE
      Checks system information in the registry
      Suspicious behavior: EnumeratesProcesses
      PID:2256
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        5⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:372
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        5⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1344
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Registers COM server for autorun
        Modifies registry class
        
        PID:876
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Registers COM server for autorun
        Modifies registry class
        
        PID:396
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Registers COM server for autorun
        Modifies registry class
        
        PID:2920
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RUQzMkJENjgtNkQ1MS00RURCLUFFM0EtRUQ1REE2QzhCOTcwfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntBNzUwQTNBNi1GMkY0LTQ1MjYtOUEyOS01MDEzMTY3NzEwQTZ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE1MDYzLjAiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iUUVNVSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxLjMuMTcxLjM5IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI5MzQ5MTcwODI2IiBpbnN0YWxsX3RpbWVfbXM9IjUzNiIvPjwvYXBwPjwvcmVxdWVzdD4
        5⤵
        Executes dropped EXE
        Checks system information in the registry
        
        PID:2432
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{ED32BD68-6D51-4EDB-AE3A-ED5DA6C8B970}" /silent
        5⤵
        Executes dropped EXE
        
        PID:4460
- - C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\RobloxPlayerBeta.exe
    "C:\Program Files (x86)\Roblox\Versions\version-492b7f0827474659\RobloxPlayerBeta.exe" -app -isInstallerLaunch
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of UnmapMainImage
    PID:5548

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4744

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:4292
- C:\Users\Admin\Downloads\main.exe
  main.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- - C:\Users\Admin\AppData\Local\Temp\onefile_2432_133581891797662630\main.exe
    main.exe
    3⤵
    - Executes dropped EXE
    PID:4860
- C:\Users\Admin\Downloads\main.exe
  main.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- - C:\Users\Admin\AppData\Local\Temp\onefile_1096_133581894847389950\main.exe
    main.exe
    3⤵
    - Executes dropped EXE
    PID:5672
- C:\Users\Admin\Downloads\main.exe
  main.exe
  2⤵
  - Executes dropped EXE
  PID:5508
- - C:\Users\Admin\AppData\Local\Temp\onefile_5508_133581894847430060\main.exe
    main.exe
    3⤵
    - Executes dropped EXE
    PID:5684
- C:\Users\Admin\Downloads\main.exe
  main.exe
  2⤵
  - Executes dropped EXE
  PID:5896
- - C:\Users\Admin\AppData\Local\Temp\onefile_5896_133581894864840018\main.exe
    main.exe
    3⤵
    - Executes dropped EXE
    PID:6124
- C:\Users\Admin\Downloads\main.exe
  main.exe
  2⤵
  - Executes dropped EXE
  PID:5948
- - C:\Users\Admin\AppData\Local\Temp\onefile_5948_133581894864869913\main.exe
    main.exe
    3⤵
    - Executes dropped EXE
    PID:6116
- C:\Users\Admin\Downloads\main.exe
  main.exe
  2⤵
  - Executes dropped EXE
  PID:5216
- - C:\Users\Admin\AppData\Local\Temp\onefile_5216_133581894870279991\main.exe
    main.exe
    3⤵
    - Executes dropped EXE
    PID:5380
- C:\Users\Admin\Downloads\main.exe
  main.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- - C:\Users\Admin\AppData\Local\Temp\onefile_3308_133581894874129958\main.exe
    main.exe
    3⤵
    - Executes dropped EXE
    PID:5460
- C:\Users\Admin\Downloads\main.exe
  main.exe
  2⤵
  - Executes dropped EXE
  PID:5480
- - C:\Users\Admin\AppData\Local\Temp\onefile_5480_133581894877460047\main.exe
    main.exe
    3⤵
    - Executes dropped EXE
    PID:5592
- C:\Users\Admin\Downloads\main.exe
  main.exe
  2⤵
  - Executes dropped EXE
  PID:4928

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Checks system information in the registry
- Modifies data under HKEY_USERS
PID:3608
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RUQzMkJENjgtNkQ1MS00RURCLUFFM0EtRUQ1REE2QzhCOTcwfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InswRTkwMUQxQi04NTgxLTRCQkItOTUyQi1DMkVGMjM3Mjc2MTN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE1MDYzLjAiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iUUVNVSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxMDYuMC41MjQ5LjExOSIgbmV4dHZlcnNpb249IjEwNi4wLjUyNDkuMTE5IiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMyIgc3lzdGVtX3VwdGltZV90aWNrcz0iOTM1MjkyMDgwMyIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Executes dropped EXE
  - Checks system information in the registry
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:3620
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5BDE6AEB-32E3-49AB-9113-EE24D4C95198}\MicrosoftEdge_X64_124.0.2478.51.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5BDE6AEB-32E3-49AB-9113-EE24D4C95198}\MicrosoftEdge_X64_124.0.2478.51.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  PID:6088
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5BDE6AEB-32E3-49AB-9113-EE24D4C95198}\EDGEMITMP_81349.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5BDE6AEB-32E3-49AB-9113-EE24D4C95198}\EDGEMITMP_81349.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5BDE6AEB-32E3-49AB-9113-EE24D4C95198}\MicrosoftEdge_X64_124.0.2478.51.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:4356
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5BDE6AEB-32E3-49AB-9113-EE24D4C95198}\EDGEMITMP_81349.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5BDE6AEB-32E3-49AB-9113-EE24D4C95198}\EDGEMITMP_81349.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.61 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5BDE6AEB-32E3-49AB-9113-EE24D4C95198}\EDGEMITMP_81349.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=124.0.2478.51 --initial-client-data=0x210,0x214,0x218,0x1ec,0x21c,0x7ff7607a78c0,0x7ff7607a78cc,0x7ff7607a78d8
      4⤵
      Executes dropped EXE
      PID:5244
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RUQzMkJENjgtNkQ1MS00RURCLUFFM0EtRUQ1REE2QzhCOTcwfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins1RTZCQkI3Ri04RjVCLTQ0NzYtQjQ2MC1CQTc0OTA1MkYwNzR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE1MDYzLjAiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iUUVNVSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O1ZQUW9QMUYrZnExNXdSemgxa1BMNFBNcFdoOE9STUI1aXp2ck9DL2NoalE9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEyNC4wLjI0NzguNTEiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSItMSIgaW5zdGFsbGRhdGU9Ii0xIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijk0MDk2NzA3ODAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI5NDA5NzgwNzEzIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iOTgxNDgwMDE3MCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmYudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvZWRmYjY1MWYtYTY2ZC00ZDQzLWE1M2UtMzdjNzhlZWE5YTE2P1AxPTE3MTQzMjA2NjcmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9VmcyQXBCTVRXM0RjRHo5aGRCdlRQa0JGc0VXRGk3ciUyYmppNGhBbEhxZWNpQVE4ZmhMNTBWNzlYN0NBZm15Rnh6WXNlbVlweWVtMDBxWXRRa0E4ZldhdyUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjE3MjY4MjgwOCIgdG90YWw9IjE3MjY4MjgwOCIgZG93bmxvYWRfdGltZV9tcz0iMzY0NjgiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI5ODE0ODcwMDg1IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iOTgyOTUwMDE4NyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTAyNDkzNjY0OTIiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI5ODUiIGRvd25sb2FkX3RpbWVfbXM9IjQwNTAxIiBkb3dubG9hZGVkPSIxNzI2ODI4MDgiIHRvdGFsPSIxNzI2ODI4MDgiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjQxOTg0Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  - Executes dropped EXE
  - Checks system information in the registry
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:6084

C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe" -ServerName:SecHealthUI.AppXep4x2tbtjws1v9qqs0rmb3hxykvkpqtn.mca
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:5136

C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe" -ServerName:SecHealthUI.AppXep4x2tbtjws1v9qqs0rmb3hxykvkpqtn.mca
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:5804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\EdgeCore\124.0.2478.51\Installer\setup.exe

Filesize
6.8MB

MD5
26ef24e23b9ae5aaaa204a4b6901a6c9

SHA1
d852dce2672850096d43ed7a9e30ca72f44eaf73

SHA256
073aec6b50085f135e8e9903806cf817950cb09b686e106d7cf9edbe6296b8d3

SHA512
a538ea6a04be7928e9533149b681d7371c6ad7274ff87207b3004ee4a436d64c5b96668e3bc91b30227dff8d5a2b30b81c50af7db99a413077f18c008d021822

Download Submit
C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\124.0.2478.51\MicrosoftEdge_X64_124.0.2478.51.exe

Filesize
164.7MB

MD5
8f229750e00f388f5de3e974c351efa4

SHA1
568c2bca689fbf870a965cb4867a76a2f5549fdd

SHA256
92f8f1114c969dde4b8819de90c6b0662e9183c733e1378a64375fe4051382a4

SHA512
09d00746c57f3928eecee36db144385b0013e307289a007a0983388ec3a45364edfbe4ded94f39d8c083a2c27d8ffbfe608e822441dfbf728cad880629a0407b

Download Submit
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
4dc57ab56e37cd05e81f0d8aaafc5179

SHA1
494a90728d7680f979b0ad87f09b5b58f16d1cd5

SHA256
87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718

SHA512
320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b

Download Submit
C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe

Filesize
5.2MB

MD5
9a5054a082e2d341025a7cfab14be01e

SHA1
6f880fa9008dfbd65ceed2022744b94d9c42231f

SHA256
324961104eeb40c40e6bd00278affe755c82d77189606280fffd37852db54c3f

SHA512
cf24a5a3b79894b93b041b2b5e71f494cbdff4cc524267b81b46c86ca5b001e3bc9a57b724f46d0bdd3ecb0fb3ccf0168db978e5928422df7023f736548c15b7

Download Submit
C:\Program Files\MsEdgeCrashpad\settings.dat

Filesize
280B

MD5
aa984b975bc01d5fc8cf63a9b9d749bf

SHA1
b244b990253fa10a9657dd8b57435e3ff0227db9

SHA256
3836f255cc31e0424c16ee72b0c5baea4f5d02d014725b18e3bac366f5b43ec5

SHA512
86ba2dc33c68e737f457fda9db1dce949fe9744584bcdcfedc7802b91defcd174163f08e6a283303c9ce59f47510f93fe61ca4e55fbc810a8e9a35709a51bd4c

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
15KB

MD5
ff8a4fa24262266c65e37d42ff1304b0

SHA1
d290d10d4d9f61f4ab32f2ee6fdf437feb46ae9d

SHA256
8dc1fd11e1402f1bb921779bf9a09a816c5035acb57a0d62d21ccc1260d7b743

SHA512
69bc40e16342331bebfdaa6c3e45af803b09fdc7e97d458b0e752cd447e49f4c20ac4da742b2c6ae5be05cdc985f9d329ac41dd6a384b78239dff652b01a1929

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000e5

Filesize
198KB

MD5
319e0c36436ee0bf24476acbcc83565c

SHA1
fb2658d5791fe5b37424119557ab8cee30acdc54

SHA256
f6562ea52e056b979d6f52932ae57b7afb04486b10b0ebde22c5b51f502c69d1

SHA512
ad902b9a010cf99bdedba405cad0387890a9ff90a9c91f6a3220cdceec1b08ecb97a326aef01b28d8d0aacb5f2a16f02f673e196bdb69fc68b3f636139059902

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000f4

Filesize
20KB

MD5
923a543cc619ea568f91b723d9fb1ef0

SHA1
6f4ade25559645c741d7327c6e16521e43d7e1f9

SHA256
bf7344209edb1be5a2886c425cf6334a102d76cbea1471fd50171e2ee92877cd

SHA512
a4153751761cd67465374828b0514d7773b8c4ed37779d1ecfd4f19be4faa171585c8ee0b4db59b556399d5d2b9809ba87e04d4715e9d090e1f488d02219d555

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000f6

Filesize
324KB

MD5
7a2499f444a0f81d580bb58a4ebc86d9

SHA1
c80e1db934e244f11892f9683444f6dd2584323a

SHA256
b4e2c97ec8ce695352891e4b16efb59d312447d3144a67c4ad609b1cee600648

SHA512
814981e4697fe9dc47264a1b5867fb0a35d8dbca2f96d4677174a4c7bf07fbb6139d82120a3ad3c3fe81db4fba0c91f7c304c6898627bd4cf3f268f3b7500fb9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000f7

Filesize
74KB

MD5
4bb4586221c885dfc2b33e6c5d9521f6

SHA1
a52ab4d34cb66f4efcf7f8e1bc9609dd6141724e

SHA256
af42662c1e129ea1a92054a725ce530446fadff87028d3a03b5a54eddf4d9d1c

SHA512
15f5186d028f4b2d94ed7a5944a43da92ddd69914e2139bb14a8220dce15d9daa93c689a70eb8236d2a86e2c14bf47ad1a170f69ecc38f7ff92c3132419abc55

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000f8

Filesize
137KB

MD5
e5122ed5257471ad89ad07a51d341957

SHA1
32c1870e500dea28294912ef1352d6422158d5fe

SHA256
a54d7204c4c16d1558db09e6eca85b604a917ed189f0fe900ada38426685d713

SHA512
2c860fa57ba5bb5cba7d9697498662afedb1e29a93e6ffc0f1151c2c4297f19f5234a4539aef8ec9c667e46eec420edf35c9be7a48ca35e9b3351fd4afacf93b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000fb

Filesize
40KB

MD5
0f81b6d61de3f11df96afa46fb362f45

SHA1
b73925c797fcb5e23b0e0495ebdfb629d16f26e4

SHA256
7171337d694e449b8c4923733effa4185a3eddb330b96e9fd0e4e3497faf5364

SHA512
1c97e4e7357d385613f05f7a16439c25614d553cafdbd18a197c4a369726ec28b372ec6bed8b87a968d74a2585e3c999da9799e6cf558fa9ce25f87010d0e617

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
ba64b7613ede0acfe9f6f4a62cec96ce

SHA1
0e0758873848097504b3dc7f861ba01722ca9060

SHA256
6b57d990b30edc9b5517a61a22254a40f21890dfa0dba2b308eb99140b8ae576

SHA512
a8b821da546ec24c5bfb14e9ceca1e0438bafe81451fe26a29b1b68cbace50edf75b3606af4957593ca695e38b19bf7d4a4d3a12b8c43b6b83e97c88e0bdd61f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
011de7b64ba7d4bc417fd9e44c627775

SHA1
36453c76462caf975a3946a3ac3ed7f98e9b2a98

SHA256
07437829adc6becc64452ecb8f54869b414617971da6012088db25139332b021

SHA512
49bc66e2f56cbc98649aeee9eb474984b09738d07a912425b1e1850eaf8c61efe3c7383a826ce4c7016ef99c08953d869bbe717d726e8a95cb0c3719e83d8c03

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
3af9e901ad22fade45760e4fe88e07e4

SHA1
63f6b65b70621e84120084756e2b89a3a78a18ee

SHA256
0efb1345c8a8ed2c3d49504f1f9286567630c41574f354a7f4e0e34afa4248a7

SHA512
d7656ef734f1e1102ad208e04fb002c012c01d23dbb71ecd297ebde16b2abb67d86e9ce2f8f0b3a191614b02cf2041325ee7d3f6bf7d5fbc3bcc1e60e5da0185

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
05c2214c0e57c7f087861221e92146cf

SHA1
85fff0377b92867a6285084c0ebad2ccbd8987d4

SHA256
6ebf7f22228da4c12ddcc16e3cab7f9e0881c3b25437c5b31d164028af0f00c8

SHA512
04291e54017eee38456bcd7c11d5f0c8217c30e86ba18fbdf83ee49139c3eff9cc231905e377fb18e15b5f0b838b92011e665a97e90b47ba43ef00fda2b95cf5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
8KB

MD5
ca5f1be2559219fecdf45b5c45647f2e

SHA1
90e90f5c0c2aa452858e0976e09ee23035fab84c

SHA256
a4f0991d5f631142091f8bf0b21a2858a09ec889a9b70f75f7a2a9a334c4cd04

SHA512
38551fda0c97ecec80f22d4996b0b9f7972588d3c996a25ea9acf7a828032e19519cdc7c4be706cc0ce1fb34f0664551ada5ca73399fafdaa7190ca30db81470

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
a40e315fcc9f808a7d2b08a7d56db63f

SHA1
22fa3444bc437659cee92fd1c25ae1c818e27323

SHA256
0eca34f596c6c75808652676025a8ef0f2b42290bef54195cbd1d9e75dc589cd

SHA512
e2925f175f6e0da5324a5d272d1b4e1afd8b3c0501371660d1e35efe7a19c93cdc8acbd039203648a2a9c367d5eff834cc849074172e8b94631064046dcad4cc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
96703d2f89d225475a136681188b966b

SHA1
604c41026b4ca64c24b02b9af9a4101d1041cd75

SHA256
d8d7c3a42b9b61a3884eab9ae51e6f7e6f98ffe1cf7859cd4ba7996ae1cdaf21

SHA512
b08117da6b0e1e96b9ed8698a9eb06cc0ccdd098cefd40bf58cca804e5f91514bebd64daefdda0557a8c0c97354ceafa1f0d3efd91e493f7df82494be2019371

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
9KB

MD5
d4bf5efe195088e532283291c77a8934

SHA1
3d8edf1714064229119c3ef67edb0ea9cc62d71d

SHA256
5ee169860b88fabdc914f7654e0b3449df42badd650474d095ab866a5cba9f5a

SHA512
b4af6805ecdc792d0f105a9bd630ea65fa9410dcb18b96359f4977afbffeab69b5462faaf41a22dd1b5dc67bfa921530abd98fe1cca6b9114df47396bb8995e3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
9KB

MD5
28d474a43aac5c8f3b3a4e4949071bcc

SHA1
c3e2752b6cfaa86604192e5f0576881d5b59fa52

SHA256
4acb586c55a25d63dbed7504ab4404c040e717db2151e0743f30e5d2bb3d43bd

SHA512
485ffbfe32357adaaa712c76df7e68c3607ef8c3db0442ebbc47bbe76ac3d36039575cf8018d0c836e9c9c59be0ff20601634c0f8355f990652156aa21708e17

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
78016fe60180d3755e474b68e88747a6

SHA1
a52a86a100b0979aa95fed76abf63487b23a0700

SHA256
b53a254b5c51bdded4f5e26f914a1017b4b10b49f0757caa7b3d17bf82a8c08f

SHA512
3617e7519b4e11c42019dc6bde39adb098fbbb8ffe503448b26a2e00f83c16a183bd24eace1edb0ca30965d13fe8bd6ecfaa53070de6f5229582cc804fff4a66

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
2ddf21db7e215dac9fcf37d09938c0b4

SHA1
0afcf365587142fd11dd802aecf2e124f1bc6d6f

SHA256
6d251cd8b72b49e3b84672a5c074cfdc9e60ff48fcb0817fb73705a1b4d2e960

SHA512
8e2073765e852cf2c9ee52581b4502d32354d99e634efd420801d44c8486831ec1a89e9fa2633321af2eb4664f4c1c7f19d6798f7af3535dd8b4c47cc4cdb944

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
10KB

MD5
3fe95f68077c107478e935ea5bf00b44

SHA1
e3f3876de9dc2d9997249b2b34058ebaa7e98aa4

SHA256
1e0f44ebc99d16184b0ac6cae226e6282cfa1443542c318880399977cb146e4e

SHA512
09892355bcb62692606b5412e641a97c9e4367c20bd9755d89a6ff44c3545ed52a09bb8bf5f69ddad74271b0cf6b557aa4a48a69ae6ec4d3e1d6f7a7400c9fc8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
23f3e3314f85426636280cf5a10eaa16

SHA1
91c61a231719d923d593acd8bf26beb956b7415d

SHA256
d4f4b740f5e1c8207ce26ae88db03d691800da24e069a25e94c452dba9df7963

SHA512
62616a75573e85d7414265fec25cd7d04ec3b1eb2684b2decc1cfc4f0efe4595ae81ba8dfb2ca908b6393a2fbc17ee13b369b05860d6208eef7bad13ebd96973

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
c30eff07399a56575fe417c82d5c0c9f

SHA1
cf52e9dabe18677721738065b664461f05a3830b

SHA256
dbf2bf706f68b445e3c9deac1a7f25f1dfec066b282e4da48d0a35823a62ffc4

SHA512
ede4f82de07ad2c0ae6bfbe1ce4c7ee461fb3128e1f210e3d7f2fc6a0554cd174ee35fff0573884efbb79aa526e362a5225848a9a864b0c5ea08b6a41f3cd147

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
2b14c80ca31be8e93a31eda122999d9a

SHA1
6691f8af8b7fd067effe2b079ee382a9850b4b35

SHA256
d6403dfb48d77adafc8fbdd69ad8da1ae6e9a44d658c4f545cb816092f866934

SHA512
897a96fb6dd0b6f197d3158354fbca574e1d8f9b20a19d12a47be9c2a0b30b28da9fdfd03d0cfbff0c416d733b9a970460427c52e024837daeb710c84dd3c01e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
f4875172227f96bd14ff03ad5e44636f

SHA1
bf061b0c7e0bf8e9993481a533ac64a26b9fb25c

SHA256
890bbd43f141b2140ed21f668894ac3abbcfd8ce36041e85a7c642ba7665c422

SHA512
9faee18ce400f3cd9fc30e80b3b031ea339e8b8e0d02c5270ad8856e60a00ba11abb2fca487f1c09820ad218b9cc44ace560ce620eaa89d87a4afb4f4e27905b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
2541b6b0b5b886cf484240f7d2708d13

SHA1
5d5912effdba59fa238ed2b4e0c861cc3e523887

SHA256
deb8babad79bdf288d76b4d04b08169609452fe3c0acb6718cc188aff089fde7

SHA512
d26656aff9ba2851fe6f366ce654a0910a2a3a1be02d37c1381c4f17f38ad3e207d9c825cc6bbec5a57d713876f3b0499885464c7873e5459ab3eaa8b7666f1e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
b0def89c28c91b8bd180dee5a84e0d2a

SHA1
31903c3bb83db5283c74af76feb0ac6c401db89e

SHA256
c3f616024d7522a234cd25e90985c5bd3445c81c9a6759cc7163276bd54bc354

SHA512
70158c281118080f48244b1eeff8f8baeec7605000eee579bf17d2f3ac8ae3f2a1341ddbd4c7dfa96e6a7dc1034ce5db3ec25a05fe471fe7db536a9af5c83bf5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
40098f11abb75f4dc01d62950d24bf47

SHA1
f6d852238806ba43ba3247d6f3ef37a181f05f96

SHA256
860cd58e0e182a7ea92d8c12eb359e3fb7848cf16f3525fadbd793af55546e8c

SHA512
8c0bc3925bda0709642c7aaab9c10bb9d482af02b18e6d44e4c19c5d8c949c87d66e93e74f8aaf3c6dfb019daeb25de4f774eaad901322c3be7e19a814c19692

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
71873f4270288d55782e3d221679c205

SHA1
c5b9996a65967be51166e0271350cb2375dae562

SHA256
0dbcd6767742052e51b108062069e2b864dc3a30283bb5020e6d93e9fe7af92b

SHA512
1211bd6f2c659493af5976ae1718ac76b45e7e77f744e7d7b475f21c42329cf6112a3e10a0fa85f0b5fcc0126bed295eb0bd31936fe680ef3810840ffeabecbe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
6KB

MD5
c93bfd0cc5967aa2c3cd102d91e60756

SHA1
edcb443597f0e9de968f4393a0adccc14b43be59

SHA256
eb0858a7804ee68429f12850f494e85db31acc558e004187e3f4bdc4bac9d831

SHA512
97e474deefb24dd69683d64f46b191e81f3bde4e4714fdc314e68c75e914e330b0f0f0512cbac9880cd225240c493bd87e1c89df943f38b6f452f1a3e0a369b4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
6KB

MD5
8716f2539a6c9a1eddaabe621524ea66

SHA1
7a458afad92736f950b655a25878cd4e4c2f4f59

SHA256
c48a49d04f77aaf312e11259c889b1b3918bdde356d238c310fbd456b5d7b5d9

SHA512
b2f0cf03de78782f2da32eaf8e3c2e5dbedea435849ad7dd6de4511fed1e8342c357a46037713e6d43143879b6ec439116840b79a9f3d9afa44c4308d25e290f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
8790a887fda762e62152df371896795e

SHA1
f6ee88961e62716d514c22a7399432d1ab4a3e20

SHA256
22e8f85461d86e91cf2e8a93d06f15a85101ef0d72c236730c17be219be0cb12

SHA512
f67bbd752172deee44b57fee7e152b6a56eee17097bba17d7b8df5631c2834d2aa9f955d76296092d4543ea682dc82894ae10a0d9f6798ba3ac463f4d3016942

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
e7edc9f0defccf5b71fd6a309f5e2fa7

SHA1
eb00159a50f14db1301584f4efe81d4f0dd0b74d

SHA256
cae28280e763357b1c1304859e96715baf164b883556c9080c52d2ff0cf420f8

SHA512
00cf95da4ec574496fe81508fe810c7a62fa813b3c7414983616562c231c68478cb832d393569c598c1c88b489332048b3972f99a28e43466d4a4c7a29ef0fe8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
fdde27afcf008cd447bb3419d96a37b1

SHA1
5741499c16e67b999e13c4f3aba9d85cd4cd75bd

SHA256
5d01c04e83a0e071721de5550caf8c1f3849fe6828e081b06ba42f2c444278dc

SHA512
4ef4314d11bd0f6108687ac7793a8b016d4ec04caf2b9cd6da7692a74bc580f7f05c57bde329db90de9c1472bd7fdf28dcbfbf8188e167c0a55b81979b8c909a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
6eef13911d5907d957f68c9fff71669b

SHA1
7a7bf1784895aeb51720d9e9edf2844066b7608c

SHA256
023bbaa843ef17ca237bc11ae44dc9fe201098d0e346aa1708429a801f5acd58

SHA512
6e3093e68b896edf05cda857e6a01ab6f368da080c6133ab6430fdd9f102bc76902b6d3a55fddc5376476b27dfd6ef78d3a15ac9120dee88dd5a73f7ebbb2d4f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
3e6fa01040be2002fea1dca2b50f3665

SHA1
939250f595a729bc972b8c7900655026a9297eaa

SHA256
dbf0020c63ba92ed9f64331a99f70f8d3fc801b0ecb2296d625bc75d7e4cc301

SHA512
020ed81d29a23aa8bfc249720214df32819ca8050026b1c4ec2c9e439009a3a560ee3e35e55626080ecbff84f30cfc35ac1bc85e9dfc73efb354961c8aa191c1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
10286c38eeac0af3d59c9b6be1ebcdd0

SHA1
7c2bcdfc606943ea5e145184db039cc4094acd1f

SHA256
d765cbb0d382adb322a8a7a2068d70a0083d9107a887b87a1fd347b9326c0c0c

SHA512
4efcd824e60d15a3b1cfd3622af13bf8a5bb8a6458045c7752c6e37b5a83e787424fd531e028b847d9d470531f084226fb3577c8c518af0fa84fc7fccfd7a901

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
c95221fdfb2df00f906fd692f6f93f26

SHA1
265ba84446f93724c87d37ef1eb5d8a02bf42531

SHA256
6c600e33855132c67462c44b895dda2f7a0bcb6ddd0ffe4bc10e1121a03b94b4

SHA512
2eb0eab34a4229508b1203e85986b1f6998097c9f4d5824f28799ca89172a8c9a637449facb1b146adaa983bcec348c594eb9cc0cc181b40ca3811df0d5767fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
284b8a43ad4b258fae62e901f69117fc

SHA1
70c0f04a001817b14b6479c1fa82f8d8dfb78d62

SHA256
47485748ee2a4d8cf76f657031edd3e20778def9ce0224967a9efa05c2ec7de4

SHA512
cd7b2cd0b7ec25d52aecaf0f56f8df39b847f7f2d718efb1caec546f7fa26ecdc1585670366cdb479fd6d02b5cbda46bc3c460866a693f76b7a3bd354fd4f76a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
aaa7d02abfd70876b35db89e6a4388a0

SHA1
bc4ba266b01258a0ac683a7e6cdf5ee4625d6dd0

SHA256
aeadca855b9a24374fe0c7445581603f582fcd224e9a8340a653f63c2d275ff8

SHA512
4f2a96f581e55aa9e161bd404390a8b4a0448781be260ec3a00958f057b8620b6c0aa820789ad157e9e17c4f0514f5fa0cdf8b9db0af27dd40f66bfe37b3e954

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
f916328c5b58a5d7754126024cfea336

SHA1
cfba1f17be9247efa203be9d4617d26349c95d9c

SHA256
c28d33446a88837acd89f0d0ae943b64c8fbf6156579fa5462cb489a925812bd

SHA512
97aec900d732b4c118e3150b450dbbbcff440df15fc611f8926e25aa29894b489e2f21644de4b7811b758cf4e0d73d67738f1f7037954c81bfcc52c5027ebe01

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
5823c947a49d475b643c8e15bc9b3219

SHA1
aff86844afeee450fb06fe7e5c6ff2e08b7adabb

SHA256
d20611ef169a5489767a577c66fab680641e8ee1f93d6bd11f67db2232a8f0dc

SHA512
49320b73ed65204c23a7004fb50b46e269483b6b8e19c5607a78963b5a37cfe1c1981a405eb37b308beffb16df857999d8cb14f92395fcb2cf2416caaa5238d5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
c5a72529d1ad5cb041995b9fad0f9b41

SHA1
a1001e1bbf5317269cb396b7ec6d66dd2b591c27

SHA256
4a7768102900112fad6f5e889907492000c540e9c27cdefd34f203498f3e5f60

SHA512
6cd65307e2e3f1eb13cc2c6ee25f415723cbcd605d14e1f1b6d89ae46b409fa9a6cafc2fc0dfd6421a30fb9ac39bbf9c0ea7840c514c7a3b7b9f27e4faacbdb6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
fee29e83affd42e6be0fa9a88d6676c8

SHA1
af76a4ae377dcf459e2861c3aab7a5d47e5cef13

SHA256
6c0e465e38b2d84fc4cbd08fb6600e82f2da0ad1913ca4b3b83a3e55c19ef9e7

SHA512
1411b591c936714f75cdaaa11f948ebe8ad5cf9dbf16f88f823ee449f2b77a98f790c2a1254bd96a1f82ddbd03700ad2ea0b46731cd6dff2184fea6ae666e201

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
486be44427ca48a54e99c6a80f99953e

SHA1
a537f2d9c9c2c0a0f46b03d615ad425c2551d6cb

SHA256
f4335930695f8c64a293b4706bba4d68c0ce98f0964aa8d323b8dc51eaab5e49

SHA512
aeaef4858fa1f4ac792653549da3c59f6cacd437389cad5f1d107aee496631b4466be4b2eca669fa81840c28bcc9d5e3be0d7504c3fd61533a90a365169980f5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
6KB

MD5
71c03e7d8666033669fb4c870274f700

SHA1
1d46e69faae3ab1979eedcfa2d1d9d098d1bfb6e

SHA256
2e757736ddba634e8fc9dabac9dc800c313dee2ccbd1ee3e436e320830017196

SHA512
55bceae1411322c5b09c8dab51ba93a06ac0931a0067797258d8df3cf26e0e706ff2a9a11d7a7e67ac6a3483e058645e66b3dfc57c30dccce350e42686165f18

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
4c10ab3d62cd84f905aede6148cd3037

SHA1
a4224a04b47a2970f78f2e95a8a3227c3bb51136

SHA256
34b508df9a5f14dd38f114b0c2007cf4ac0a6493c55ef558ab3a82916d647b51

SHA512
f19315396b7499518477a73eef65b4fff80d0cf9c8419266934c1a75b3a8838c8d2ca9c5dd829ec797923d7a4a497b12bfa1a7696b8607f2129c0127e62a0ce0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
74871231f0f8d82f59aab25d50e1d35d

SHA1
39e5142503a80ab040a0f1c477c81b4289ee86d7

SHA256
53a40c92dfd62f61c6947b6a74430f18c369a38d14d95535e6766582a77230cc

SHA512
45b0b1b1d2f84dcfdee642a766a8e6743cfb7d89bc72806aa5fcfe0d26b7b5bfaa4502ed405525090fbaf17c982a96ddb1bcc965a869d02618e2c077e19f5479

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
98a4c9861f679a94f304abcc83cef856

SHA1
bfc536fe186a99b6902ee1ea5b8d47bec299400d

SHA256
dfc273dd1016c203cab78e4e9dc0dc4cdbc15035ae5daf8ccdb2e20527740fc3

SHA512
b3d4bd056373bc28fae93ac9a0e04a083b1ba0f8c3ddfc7c9cfed85d124c9964d155df67d080ef4d76ffe4229b84208f8256afbcc5208c87cc0c3ab68fd72c55

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
620cff49ea1e2e2218511205db5914f4

SHA1
135edc5b5fd1ba7092dd040c9a0d576af2ae764c

SHA256
1597c51a20dad269bf474b87349eca61b7755c85385fa2f6955205b1d29379ab

SHA512
68d8d00a197e6a096b644a78e8f12b3ce824afb6be49250b19ccd5edf0895e055d560acf95013cc1cbe8927b2a05a4b4f3fcc50085ee4e1259e002f5cdca855e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
b94fd5f6db6b08cfecad44776702d76e

SHA1
154ae5a7de88222430518b3ef0961e63c9269947

SHA256
9103b2ce8440ef31fd66b1ae1801a8e698376d40275e4ec950599fff46b8b970

SHA512
c998ec8e9df0d2eef2b27b055b1a3ec3f4e84267844d7cd4f10197d1497b237d6d9f83027ff316b0338adbeeb967f35f162ebbbcbc81868e0ee17de7289564fa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
671fdd17f800dcadf5462b0d5a877e96

SHA1
18c33b2f853fc386d8f7b1f2e791d38aefb648ed

SHA256
92cef3c348a98f26774eeb5723a91d18b8f269abd485faeb13bb620bd28b7cfd

SHA512
80cee0f9396891b0bc1ae302c68ca3a38a8f57a9fbf6cd094f9174cc6e4d936654bf0e4e1f0b17424bf900f1f15a974dc94583ca0c6bd827d9b26bdfac4446ea

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
cc3e52ce6d72057ada4383e921251ca6

SHA1
b6d28e07541bf081d0ba87424306ac8d1c18567a

SHA256
61e0d8c0db313c45ce879f70e55cf00651a6240fcd016df0d46b90721833e6b6

SHA512
fcfb79765f2ecd387a73978a6c8adf5a80e58f37c868fe4695d3d49b5c5fc8de20e7c8af03779c2fd99f316e3a8c70ea19b0061fc45783c2f7c58d6ce8a7b00d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
2a5fb12e9d79b15002e5a474bcbd466d

SHA1
4f3a3e25bf5169028d29a914e93798547b1ff3c0

SHA256
89c6db008cc0ea40c914288da1b711983cac2ba812cad00bf9d2e39a6789ebae

SHA512
97aac867276d50849b874e6bd8feccf11008a90fae4da32184a39559fa39bfa46b411649a21ea8dd76b64c8ee3989cbb02d0ddf3353bf664eb2b09ec3cbf7fcd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
61e24ac0a48facae29907ccfb543b40d

SHA1
8e5f160f97a1ea7926038160bcb88e5701586913

SHA256
ce861bfb28c0cde4542ff124ebe186a346848f0ab09341abbcfa6a799f57c047

SHA512
70c9fd442772cbd9f9a83cd4d2a0eaa5cbf8356609474f08fbdedef9b5fe131c5aa8b6d83de288a53016cbf6b9d2320ecfefe07e6b99ebf9a8fe701bab3d1775

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
54f0b1d612c4026afeee5e24bbc5f8c2

SHA1
6500be9620eb54f9619cffa999cd34976eadbc61

SHA256
10c4ec00175408fb265ed7ff9a7f0807d63babc46ea953220fac1bcdfb9635bc

SHA512
2e58d0eee8150458fe56114422ed984b58b32daa4afd9b7d54c9f5f3bb8a96c48f477e90c8d8762985f084ff791a696338a86abb04cb25f3ee684275ac32e036

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
0c61e661cd9fd44ad025690ab9f521d0

SHA1
c6f37f6a46adeac9991cb659c5ebd404d0c26b00

SHA256
9382bb9034dce2c435e27919b188d7a7ce7111e835f8eb5d21ddddcb381d6f02

SHA512
3a30875576d2d903cf8441e22988e3609d622f9c6f39a4a5e8a30d52584f7b58afe1f3b01b0c4c3b7bb06852259994e8cac71495972ec9b5b06cd306303b9b50

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
6065a86c89d2a71e66a8994c8569d39b

SHA1
bb0f7e4d7f8c28f4b3539c94764d37de9b606329

SHA256
0f90a314e11eaf21aae21cb2d1a162feb89cba4b4d2e42692ef7b71366b469ac

SHA512
8fd6870bd2346ffdfe73ebece155785219bb72dc907b983fc340528137e148706aec3060fa3d3c430b9b7e91b94cdf3b9e4b9c3761809eaa915bda7fd570b1a9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
50dc6b4c6779210db6476dfb0742bffc

SHA1
a5406102079c5844bf623078d271d6b8d8f48c2c

SHA256
09aeea507f1b03220eeb240d16f96ccdaf32c8ddb6702b208e9e9ab54e3599e4

SHA512
debd6af7c18d3da54a5523b02832738e145f538325f6cf9e2190edbf63d1e259498d620d7701414268eefee3c31b530aa99fea99c764fc274dd7da2f4309d3a8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
04ef689165f0cc5bf48a371f66d7fe40

SHA1
d4a4a84694b1155e53ded69964d83eac4768c06a

SHA256
fd6c5c265d68d28f4236d4af727f174c7b2a974741a5602c947991c811232b08

SHA512
b0138c50aa53827db68ad69f306f3ecf1d995642f5c0e5fbea6e1e01a00b45375fc75fb5a139e84997f07cd9470652dfaa35c45cb62c8705c52fa71060b90e91

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
12031eadeb2dc8a4208748351ce5fbea

SHA1
02ece45c9997053b4430baf6400ba2269fff4667

SHA256
89e22dff1c110019c4a8340f11ea786c50460d73f5d9f68438f5a245d1cb356c

SHA512
ad18595197897413c82c288e223261bb0ab9f412587045f49806fbd21691f8cff107c4b83e7bbadc000b81e3bebf80a0b58bbb3758d6a5ef42100d2a4c31ea22

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
ac7896beb3cf6167265d3948efd9836e

SHA1
d47dcf9f68e8f284223302fe9902e70a889fd598

SHA256
7b3cbea4c83f7f335f486675b1532ccce59309a051334bd460791250609ddfdf

SHA512
18113f18371ea1e9e6dfa16b3d2fad21d34afb2be0dbff0976ca65f1bd7a871992783e848b98559532ca9175522a3194fcf73a60c631fdc1dab046491eeb1822

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
969bf94cbfcf8c71ca1f867b4cf6dfc3

SHA1
306ed83193f34991e04953e11f784e2ad4bc45dc

SHA256
19474695e971e09eaf75350f728024a4613ba5dbcd2f365130415e99a5fc92bd

SHA512
a1c12239357550acc8a6366976c908dd6437b3a3968b7d0db98f58ecda0b974f8b0533ad77e83ec696e68061b6cb439448604c958a9f2b98b01ae033a58e9914

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
9cc27dc721bd07e78c4ab7df0937640f

SHA1
0b1bee2b6964c6ab85809efe0405bd1497b81bee

SHA256
4f38a096c6c4b851707fca1ca78f1815af2418f1661071fac69442d8f7c6fa8d

SHA512
fa0353db2f9ea7b1f3aada0d8dcd2fffabad33d5355ec47bb9e5b557d3b94ab3f0a93b6e3a5f32a9ab2b6455a8d02963a61bcddde6294aafe3a36a79c75eed8a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
5ecf10476de627e1cd0e126717edd632

SHA1
2d60d88dd7673f5cf30f2872505d8ff29a1a7b99

SHA256
18e236a7cd479d9165d36ad7d6ab8a03c15c1277fe4cdb3d26a93df1e50ca085

SHA512
6b582e8d2fd3b821195dc7a0c232a208830a1ebd2aafa703f613f816e87051d2154143036dbf18df95ded57e2e5ed4db0c7d630d35764acf2a43d487a69f4609

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
f3dc07d412b07ad9c9e245e3ad706bbd

SHA1
95e978ad93cb662d35a6712c9bb96d46034a6f1f

SHA256
3f390c714bca01fdf3bfed617c88f46eda9961304ad49288dd2faa7700721c10

SHA512
9c9d99cccd3e854cce34b86ee1ee0712634e8a419277609523fd6866ac82c9a3ffe734e367043b7a7d79384986f8e6478308d46aa86fb4494838667b777f5071

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
3149c2756fd4620bcb73c57467198434

SHA1
59417d8dc6379d405ba1cc34599b73ca716805d4

SHA256
a00964725c4e109274af05287772f34ec13fbe2b0d7367f7a76bb70216e22745

SHA512
84d3f1e4716c9af258765236ea21b381412652ed0a2770672a4c110d397d366e0b913e289694b76d5aeda843abcd5b6329675e65c8e994a1ab254ee024a62c1f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
3dcd5e7fe97d6ffb137628565f355104

SHA1
e0302c4f48ba784a32288ddeb0135b985f2f2155

SHA256
c75f25490288fbe8f86dc4de4495ec67689a795e343c945101ed775fafb6c494

SHA512
2875b8483fd428f622ffd420c40eb6219e4219c98e22da4d6f5e53ab5f33110296ac0d507e31f5fbb7b472b77cc8d09907b0d04262ea4b99d34b664e1342a85c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
ec3bac01d773643492879570b53cee25

SHA1
e21677e0ac64a10f50e5a3af6c1037141ee9d22a

SHA256
0029a277f53b5e32bcc2b2c4887af207d834bab0b5ec779a6c0baba6219f1ced

SHA512
c801b8cfe12bd0c4b0b9b1cb2783c979f27a5cc590e5d2de4d7c2939dfdfd62b0d5b6a2538240d028a09d5a003d47e13f8f1324eabcffb53d4618bb3e4827c86

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
64f24704f4221c281ca655d08aae66f7

SHA1
f3307fc39850559882711363cc5ee4d92eb32c3c

SHA256
e3fc3bcf92a01516d775e19f2418fbab4b7fed1e2bd6bb5ab235d4cbc56b7095

SHA512
8b9803d614b2f5138ebe45f93f790943bd87cdd6ad6030462a2ce9e75d341583e75b11220dec2118be7babf069c5b2e7f2742b2a4fa26b1ca112872a1020fafb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
d163f5bcd4cd88cbe295406498809909

SHA1
ef3e800f2a35962981e19d4362bef2a77b730e38

SHA256
aaf160eb9c328941d3375df176dd0dddd0aa5c1aa4e7e551a3fbc219b0e5711e

SHA512
e469dacb59f3c4ee540eec51138a48fcfb35ee0faae8c9518729959699072b78e695945b99875010066f8c947e56cbf5357325ccdb11c374fb674cc27c49d186

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
7a0e104c936399b51a5d723b640992be

SHA1
0a37de106daa147f550271818e3173a645a484a4

SHA256
f9f0b066ae6a356b4ae8cdbe0646e16e8874e3bc79674c6eddb2045f641989c1

SHA512
f684275b7022afcf9b1f1da4d1f5a8b7a52955622cdcd94ee1bc98fd0712fb9895d8bcf5dda99a87669cad46e45602510a646a8c903378a5e9e0e10734e41104

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
00f1ea0f0202625bd3a86def2cc83f50

SHA1
6fc6ea104c967c2d9edf887305766ed0823cdaec

SHA256
98598c4c76039f2f6bd95231cd3dd27916194ff043a29bbf03b77b8b466f924f

SHA512
1d8563ad97897cf71e76a9e772a8609fbd6412acbf07d9856c7550dbfb74fdd695a057b94be0ce35b685c43fa00bd284a990649593e8e76090192ab25e331c22

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
9f428b5fa57e3c11c25e864fd273a424

SHA1
cad669e9288cc3e1d46c8ef95f798a58de1f946d

SHA256
f7be4db10012b1cd0ca0ee5e110a71ca221fa184e4469d58bf8f9c2b16138e9c

SHA512
6d672f18596482fe684a0ab88c518f90edf1448d8b93a374f5ece5ffce71f54379f1f67542c1942936dec747d4a5838d6f696d57a4b7156e17897b24fcf01610

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
d65919e5b59eb8e0d77981e8b96d9cae

SHA1
ebf11c18b239381a69ec0530d4b1cbad7d5729e4

SHA256
3c8efe40d72e83318e6310227284639e24dc28c34ba3f8ff6d65e792cd1b492f

SHA512
2db0517bfa15bfbd51c35ca4e83ac8dfb776c1b60c6e505f162084e1075e2d3c581f64c37c66f32c69a12f1282951e235db2124f04fa9aa9e71f8d6a44efa195

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
624fe8d50fd3a5ee4221e6ce599d02c5

SHA1
2046d0eac54a79f089c4bbf2a08dc30ee6b7cce4

SHA256
9f163aa24eec347e8928a96d906305aec54a2f858430a9f10b873fce0a911f26

SHA512
1ed40acf9d130ec9aa47d2b484cceeb3c91dce8889f30d7834465d161d254c40d4dcf7721d7eea8dd9389cdbe24a2ab467ce85bf5f1c742ebb76490fb1043db3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
5f4de38c4cdba2e52d1ca8e96cac1fff

SHA1
0ea47809103240f6222ad8a72870f15e0c822aba

SHA256
4e1ab0404292e44fb701bfe1224f8ce90614bebe1c099ac026f77158ac95705b

SHA512
b7d2df1b6f65d4b71cbf0cef91e59313af89bb5677ee21cdb902feeb57a8ae2e50aec0eea7e1f95bb1b219bf40f8043d96f50d1f9563741a7c68b29667f25375

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
56B

MD5
b6f48def1ad0dc727f479ce8ffec8a6b

SHA1
488a3d7c23f20d7c90d9cd3010d31836d67b4028

SHA256
88b9c140ca5cdbc682401e0cd009ef606ef17510c596d69c12b629f720543aec

SHA512
ff657c31fa12c36894ac6002bbc33c3263739b9727aa255687ff9299087d47b2a6b390cd0bb6ce588b992c245e497f5e9178de97bec3c72a2d696160dd9f3a9a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
120B

MD5
8dc386de30f21c1b6b5ad38d9385f2f8

SHA1
e86e88f2823cdabc79033d64e7de4336b0eabca6

SHA256
ec51934b6f8f871501844f55473fb8a8c6fc266738d37e6e69f960d296467bb5

SHA512
94ef840397f3eef95e5a8975cd0b9cc4ae00be78889a6c1ea4e9437ce4681684dd7f77224ab8395ab86217062e757f81788a9e9a144c67735837e50a64f6f826

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5b7125.TMP

Filesize
120B

MD5
3e4b104dfe11e35626e7e2ffd5f5c13d

SHA1
3dfe4c968a3d63d46548ecac8a0cf5dcfed13533

SHA256
f4e8b6d814b95aa02529965a2424136ba14e53b8b2d2ec27fd1cb59df602a112

SHA512
6a1fe70b1031563e2566402327c0991b92decffbc3e3955bf5eafc23c652b353f796f78a1e433268ee5c7454e8906f3f69f08f4e0cd2c97d37ff193959c9153f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\000001.dbtmp

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
15a2a268f707765c12ea4026e8827af9

SHA1
e9c5d84ad19e5d91024df2e3e4fef9b413a4f0da

SHA256
a2c0c0b0fce61eebbcfd029f2951dd0d2081e565d558c316e57d440350aa1048

SHA512
2a3996349463c0e0f6379364482ec5450d4961f06beb4a2d6b3ce6706115c78a9fbf49636bcdd87fd0ce60b87b084be9507274a0dac25b36f92b76de3f5e1985

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5ad0ce.TMP

Filesize
48B

MD5
223754d6e1c93d976e443502ff931d62

SHA1
ebee5310140757e519ec6aeaa42677fef1bfd29f

SHA256
c54dce397e628bb1f5f00c657552553c761befd2dce7556142edaa3be5f1ef99

SHA512
094297cd8dc379f34094f629ebb98f74660dfea8d94b9a190d65a7c9f6b244a318411d0e391b0d6dce9f365c26752a5c30ee78538ad14a1e84d0f9ed75962c56

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c1f89f2f-cacd-4a87-809e-e7dc3414b139.tmp

Filesize
7KB

MD5
31f6571ce397008d28de689d7a3038b6

SHA1
22596a95507c6ade62e19c664ac0dd71474b8a8c

SHA256
36f9d9118a1c1224e772c52e02dc0dd2da33dc66564062bd7a38b8cfd63ea674

SHA512
e4d56f1d24ef6a7488fddbc03178209ad92caa18e685c3a12757ed3ec0476ab3da8a8d034b2e01895d15c0801aa37abdd457cda81fed22028b378e4fc8bb9f5d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e2b22e82-217b-4a56-9484-3b8dd977416c.tmp

Filesize
5KB

MD5
6e9ab83219d98bbd7c16b8dc654b5340

SHA1
53e831a97f0efadf960b24fe9518a2270fe2d17a

SHA256
c05560866da90ae41404773ac2331cf531158862587563d0df843f5de27c7884

SHA512
e7a69d9ea829454449aa79aac819fed64fcbe276f65a7f05f253e0811331df1e7d436cb5c756de6db6b7d396ba6962c1fd9722f39b0990217661557890824209

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
136KB

MD5
f88ac8e6dc8eba421aff6d505b3d0103

SHA1
9e8cb8bb0b01cba66302e3de5f472dc6ff113b84

SHA256
7a3f280d5f697745fac9096098ed8f976eb44a1ed7b2021a15e226cf5ace4e91

SHA512
d6691455c80c40d16c000854b3b353120a67c31f3c47ad6d1bb12417aa2bb142cd6023c4f91aac03375b7b53360189d09769ebab6ffdac01efb5bf2c607623b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
136KB

MD5
e1672f7d3d00759f8e7bac00bc26b76e

SHA1
633a59bf5c4b3b05f5e84851553b1f74210caf05

SHA256
9adfec245306cb005c8e22f20a3885c56b0267d92ccf0bc1d757aa9ed385456a

SHA512
0f956cf39cd1512fe9792f0e838f122f390aa83e9c40ba8a446f5781ebd38513c72ad7393beb5665a7e40be91f5b77b5014c02419a269a0b3b9576c6d2f333d8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
136KB

MD5
aee032e9c7b2823220dccd9897cc6d7d

SHA1
d493be2168f4caa166a89e25b9eb10831f54f6fd

SHA256
886c2801d10a1954616d1dc2a1d8dbd17ee399ea82919d30a8a72f6b06234f5f

SHA512
74fbfc9824a92f7be88dfd7b41b9c6a266be46c4a882f1f60572bb9b78c548a4d76bc8cecfbbfe3c589205fdb89fced122f7311cf561740866fea2a57bb735f8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
136KB

MD5
b98914da0b49d8d792bf2e7f4c7234c5

SHA1
a6763a5ae9328f3c7fcd838bae8b31f014f5ed9e

SHA256
5c51fda6fe04a1a241d607cc53a20d25989c73b25690f5153cded95197849b5a

SHA512
313ac62aeaabbc5bbb17af5050360b6443146760d4b5dcb01faee3ff4c9ea83c080c98bdfd48b78c2ce47b438d5a3133112b5ec4df07ac21dd8ccb718729570a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
136KB

MD5
612ee872a655af11e7d0208ece1504bf

SHA1
58d0bc88bfab4065b0b7b32bc45ee99d60bbfe10

SHA256
f74dc54db4c142550f0f640baae3b717f365f19bda3e50b82468e618cc716211

SHA512
26f584642f11ea6dbe3cb81b79a381c0e84ff86193bb9ed879e51763a935aae6aa3d207a1f3f244ae12d09441f118771372b17ff8905d63d66be953d18921d29

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
136KB

MD5
763e530f3b1e77d096900b7be7a3d3ba

SHA1
04f55408c57ec8285c78d99bc8434a3cc1079d44

SHA256
1c907674fc1333d609441526e0d92329ed22f4234774ee14d8186b69b973fbbb

SHA512
e4669fdb598eaf6a910123cff7f9e2a2d8e14cef123a028dace844035de6e6f7bb80f5a37780d332a1e90e9c83fa59e5c2eb840d7fd4197c5ec35b13022d70ce

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
114KB

MD5
0cf1f3ed47f52409d5a70e14c787958c

SHA1
db2ac4c0444afcc1c503fca2ec98d366bfafafed

SHA256
0ca0953d221bb75c604636784e2f2d0daf332cc237d6f64c20bdda1268c43a59

SHA512
5a5663387573b5f1658c060dcdf40d3d07cd1d61732f45028d2669109d7fb82264faae66efcc84a4850214f9e176dc38d3a1535de40b2c86b5bec013fd777171

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
111KB

MD5
555963ae02b516e17db31e9b903ba94e

SHA1
fe4534e3061646799b6c8d874a39f0cc5b368973

SHA256
1dceb3f5057a2af1447b0521ea41186fda9b9e3259b90576710bcb565fe4f23f

SHA512
5ce2f4a45c418cc2bf858316fa1c14a6277c645338b82d58bf2ecb76da7c1e4edade89326762d81e92e3de02787a689a70889b55aeea7bd7fde1bb15316c28f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5918ed.TMP

Filesize
105KB

MD5
87099746500541dc561fb10819dd749e

SHA1
e38fb89e98f0fff1f9a5a44ee2fbee8c96ad7844

SHA256
007093b9eba10a99e6c0aa3a782e592145764ee277bc5f4b0bbd6e726bf085bc

SHA512
ee2fde8f4661e3329bad0c1528e040df93a308d689df4d7eccefbdaa23dc6633deba3f989bd4590f367f064e69b3315325557091cdb4c2f67e6fbbd01785dce3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
14KB

MD5
ee12c19cf457f46b0d7894e95e96131d

SHA1
06f162b04345182a030d90b19116cd91cb3dcd9b

SHA256
431331b730bfb2e6964fb3eae58a3627cf140b9c045171028dd2438ea78aab0b

SHA512
9aaf41a4bd6a485ee488353d7eca945ef393df250d6e02efe1a042313f0b02cd4a0531924991c80d9a3a8cdd6356a77d5807a16277f36f531a36ab7313494214

Download Submit
C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\0106ef73f91b2bf65b225d25ca66840e

Filesize
5.6MB

MD5
0106ef73f91b2bf65b225d25ca66840e

SHA1
a6d345114879d6f7bba0352bab4e80a2688518e6

SHA256
5ee503ec8e7fbc6a32d20b97dbaf5e1c85bfbaf31f8e393cbe20d654dd86760e

SHA512
544013691c28f6e1741d65c96c461b7850c0ee0f3a27c8ca1d631fe5df1733aba3e78fcc94c6f96b602d5fb351d9f843cd593f413114482b9816e4422aa33aaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\dearpygui\_dearpygui.pyd

Filesize
3.7MB

MD5
a61fd33272eed6d4480b26007e87250c

SHA1
4534508fc9231c96a91214be5744a40d3909d2d3

SHA256
2fb6469ae47259d6d6babc07fabeec430f71e7d3e9cc6fd22e11e5a14b13b99b

SHA512
d0b1ed776578d05fa86b7a2e5d2f2f1cfb83ba73f37fefa3a29bd8681467b43f4f6bd43ea83458744a678beefbc59676d0245f30a7ad63f5b5ff3e60e01ce139

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libffi-8.dll

Filesize
34KB

MD5
32d36d2b0719db2b739af803c5e1c2f5

SHA1
023c4f1159a2a05420f68daf939b9ac2b04ab082

SHA256
128a583e821e52b595eb4b3dda17697d3ca456ee72945f7ecce48ededad0e93c

SHA512
a0a68cfc2f96cb1afd29db185c940e9838b6d097d2591b0a2e66830dd500e8b9538d170125a00ee8c22b8251181b73518b73de94beeedd421d3e888564a111c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\win32api.pyd

Filesize
130KB

MD5
1d6762b494dc9e60ca95f7238ae1fb14

SHA1
aa0397d96a0ed41b2f03352049dafe040d59ad5d

SHA256
fae5323e2119a8f678055f4244177b5806c7b6b171b1945168f685631b913664

SHA512
0b561f651161a34c37ff8d115f154c52202f573d049681f8cdd7bba2e966bb8203780c19ba824b4a693ef12ef1eeef6aeeef96eb369e4b6129f1deb6b26aaa00

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\win32gui.pyd

Filesize
212KB

MD5
3c81c0ceebb2b5c224a56c024021efad

SHA1
aee4ddcc136856ed2297d7dbdc781a266cf7eab9

SHA256
6085bc00a1f157c4d2cc0609e20e1e20d2572fe6498de3bec4c9c7bebcfbb629

SHA512
f2d6c06da4f56a8119a931b5895c446432152737b4a7ae95c2b91b1638e961da78833728d62e206e1d886e7c36d7bed3fa4403d0b57a017523dd831dd6b7117f

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\win32process.pyd

Filesize
52KB

MD5
936b26a67e6c7788c3a5268f478e01b8

SHA1
0ee92f0a97a14fcd45865667ed02b278794b2fdf

SHA256
0459439ef3efa0e0fc2b8ca3f0245826e9bbd7e8f3266276398921a4aa899fbd

SHA512
bfe37390da24cc9422cabbbbbc7733d89f61d73ecc3765fe494b5a7bd044e4ffb629f1bb4a28437fe9ad169ae65f2338c15d689f381f9e745c44f2741388860b

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2324_133581891438747942\_bz2.pyd

Filesize
81KB

MD5
4101128e19134a4733028cfaafc2f3bb

SHA1
66c18b0406201c3cfbba6e239ab9ee3dbb3be07d

SHA256
5843872d5e2b08f138a71fe9ba94813afee59c8b48166d4a8eb0f606107a7e80

SHA512
4f2fc415026d7fd71c5018bc2ffdf37a5b835a417b9e5017261849e36d65375715bae148ce8f9649f9d807a63ac09d0fb270e4abae83dfa371d129953a5422ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2324_133581891438747942\_decimal.pyd

Filesize
245KB

MD5
d47e6acf09ead5774d5b471ab3ab96ff

SHA1
64ce9b5d5f07395935df95d4a0f06760319224a2

SHA256
d0df57988a74acd50b2d261e8b5f2c25da7b940ec2aafbee444c277552421e6e

SHA512
52e132ce94f21fa253fed4cf1f67e8d4423d8c30224f961296ee9f64e2c9f4f7064d4c8405cd3bb67d3cf880fe4c21ab202fa8cf677e3b4dad1be6929dbda4e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2324_133581891438747942\_hashlib.pyd

Filesize
62KB

MD5
de4d104ea13b70c093b07219d2eff6cb

SHA1
83daf591c049f977879e5114c5fea9bbbfa0ad7b

SHA256
39bc615842a176db72d4e0558f3cdcae23ab0623ad132f815d21dcfbfd4b110e

SHA512
567f703c2e45f13c6107d767597dba762dc5caa86024c87e7b28df2d6c77cd06d3f1f97eed45e6ef127d5346679fea89ac4dc2c453ce366b6233c0fa68d82692

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2324_133581891438747942\_lzma.pyd

Filesize
154KB

MD5
337b0e65a856568778e25660f77bc80a

SHA1
4d9e921feaee5fa70181eba99054ffa7b6c9bb3f

SHA256
613de58e4a9a80eff8f8bc45c350a6eaebf89f85ffd2d7e3b0b266bf0888a60a

SHA512
19e6da02d9d25ccef06c843b9f429e6b598667270631febe99a0d12fc12d5da4fb242973a8351d3bf169f60d2e17fe821ad692038c793ce69dfb66a42211398e

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2324_133581891438747942\libcrypto-1_1.dll

Filesize
3.3MB

MD5
6f4b8eb45a965372156086201207c81f

SHA1
8278f9539463f0a45009287f0516098cb7a15406

SHA256
976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541

SHA512
2c5c54842aba9c82fb9e7594ae9e264ac3cbdc2cc1cd22263e9d77479b93636799d0f28235ac79937070e40b04a097c3ea3b7e0cd4376a95ed8ca90245b7891f

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2324_133581891438747942\pythoncom311.dll

Filesize
654KB

MD5
f98264f2dacfc8e299391ed1180ab493

SHA1
849551b6d9142bf983e816fef4c05e639d2c1018

SHA256
0fe49ec1143a0efe168809c9d48fe3e857e2ac39b19db3fd8718c56a4056696b

SHA512
6bb3dbd9f4d3e6b7bd294f3cb8b2ef4c29b9eff85c0cfd5e2d2465be909014a7b2ecd3dc06265b1b58196892bb04d3e6b0aa4b2ccbf3a716e0ff950eb28db11c

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2324_133581891438747942\select.pyd

Filesize
28KB

MD5
97ee623f1217a7b4b7de5769b7b665d6

SHA1
95b918f3f4c057fb9c878c8cc5e502c0bd9e54c0

SHA256
0046eb32f873cde62cf29af02687b1dd43154e9fd10e0aa3d8353d3debb38790

SHA512
20edc7eae5c0709af5c792f04a8a633d416da5a38fc69bd0409afe40b7fb1afa526de6fe25d8543ece9ea44fd6baa04a9d316ac71212ae9638bdef768e661e0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2324_133581891438747942\unicodedata.pyd

Filesize
1.1MB

MD5
bc58eb17a9c2e48e97a12174818d969d

SHA1
11949ebc05d24ab39d86193b6b6fcff3e4733cfd

SHA256
ecf7836aa0d36b5880eb6f799ec402b1f2e999f78bfff6fb9a942d1d8d0b9baa

SHA512
4aa2b2ce3eb47503b48f6a888162a527834a6c04d3b49c562983b4d5aad9b7363d57aef2e17fe6412b89a9a3b37fb62a4ade4afc90016e2759638a17b1deae6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_4920_133581890911106681\main.exe

Filesize
9.6MB

MD5
d5a86507a6d25f4094e65d89d3e48ce1

SHA1
079e2cd15767c4aee2632a795ded4d64b0387e67

SHA256
953928cf3022590bf090a2edd9a990d64443c2346a47680f1a6d42e5f93a2a63

SHA512
e49cb9c7d7d39ed3269941e60a47eaa9a6dd12d31ad2ef7a67b61a5630775b6d596624b0df8a4d9fda4691bfcdb71d5d09c40a61db5dac4d00fc521db750c034

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_4920_133581890911106681\python311.dll

Filesize
5.5MB

MD5
9a24c8c35e4ac4b1597124c1dcbebe0f

SHA1
f59782a4923a30118b97e01a7f8db69b92d8382a

SHA256
a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7

SHA512
9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 364828.crdownload

Filesize
7.5MB

MD5
77c1629bcc10cf5c9912d9d677729fb8

SHA1
f88fcd3a5eaa50a896bc9b82ae9118fa559ee454

SHA256
a4a600f37ec189c434480b05e390413b92369d4b9e8ef41a54be17a58db9bda7

SHA512
28d286699db27816f56c5756ff72199e0a2796baf3c4cfc8f0f047f29c75950ca8c0141307ab56395319c72fc2f9b2f24b9659220a006cd539baba38176577a3

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 894065.crdownload

Filesize
5.2MB

MD5
0c1b8a4ef9d42a8bb164a9cb3c6d5f13

SHA1
ae69fa0b3266efe502b5c6fcfce897de61db027f

SHA256
2c06eec63b04eb812ee682e56d9d70896b15d1c647929e26f9d85cd383e667f3

SHA512
882821984373f14d1d245d1bbea77b77bc92fe9012604da0151835c5822c25289ded8cbb76663fa29d36f231b28d8057a7a835f49b97761fe89f7c727e563dfc

Download Submit
\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ctypes.pyd

Filesize
120KB

MD5
6a9ca97c039d9bbb7abf40b53c851198

SHA1
01bcbd134a76ccd4f3badb5f4056abedcff60734

SHA256
e662d2b35bb48c5f3432bde79c0d20313238af800968ba0faa6ea7e7e5ef4535

SHA512
dedf7f98afc0a94a248f12e4c4ca01b412da45b926da3f9c4cbc1d2cbb98c8899f43f5884b1bf1f0b941edaeef65612ea17438e67745962ff13761300910960d

Download Submit
\Users\Admin\AppData\Local\Temp\ONEFIL~1\pywintypes311.dll

Filesize
131KB

MD5
90b786dc6795d8ad0870e290349b5b52

SHA1
592c54e67cf5d2d884339e7a8d7a21e003e6482f

SHA256
89f2a5c6be1e70b3d895318fdd618506b8c0e9a63b6a1a4055dff4abdc89f18a

SHA512
c6e1dbf25d260c723a26c88ec027d40d47f5e28fc9eb2dbc72a88813a1d05c7f75616b31836b68b87df45c65eef6f3eaed2a9f9767f9e2f12c45f672c2116e72

Download Submit
\Users\Admin\AppData\Local\Temp\onefile_4920_133581890911106681\vcruntime140.dll

Filesize
96KB

MD5
f12681a472b9dd04a812e16096514974

SHA1
6fd102eb3e0b0e6eef08118d71f28702d1a9067c

SHA256
d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

SHA512
7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

Download Submit
\Users\Admin\AppData\Local\Temp\onefile_4920_133581890911106681\vcruntime140_1.dll

Filesize
37KB

MD5
75e78e4bf561031d39f86143753400ff

SHA1
324c2a99e39f8992459495182677e91656a05206

SHA256
1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e

SHA512
ce4daf46bce44a89d21308c63e2de8b757a23be2630360209c4a25eb13f1f66a04fbb0a124761a33bbf34496f2f2a02b8df159b4b62f1b6241e1dbfb0e5d9756

Download Submit
memory/5548-3045-0x00007FF8AEEC0000-0x00007FF8AEED0000-memory.dmp

Filesize
64KB

Download
memory/5548-3049-0x00007FF8AF010000-0x00007FF8AF030000-memory.dmp

Filesize
128KB

Download
memory/5548-3050-0x00007FF8AF010000-0x00007FF8AF030000-memory.dmp

Filesize
128KB

Download
memory/5548-3051-0x00007FF8AF090000-0x00007FF8AF09B000-memory.dmp

Filesize
44KB

Download
memory/5548-3048-0x00007FF8AF010000-0x00007FF8AF030000-memory.dmp

Filesize
128KB

Download
memory/5548-3053-0x00007FF8ACF80000-0x00007FF8ACF90000-memory.dmp

Filesize
64KB

Download
memory/5548-3052-0x00007FF8ACF80000-0x00007FF8ACF90000-memory.dmp

Filesize
64KB

Download
memory/5548-3054-0x00007FF8AD000000-0x00007FF8AD010000-memory.dmp

Filesize
64KB

Download
memory/5548-3055-0x00007FF8AD000000-0x00007FF8AD010000-memory.dmp

Filesize
64KB

Download
memory/5548-3056-0x00007FF8AD020000-0x00007FF8AD030000-memory.dmp

Filesize
64KB

Download
memory/5548-3057-0x00007FF8AD020000-0x00007FF8AD030000-memory.dmp

Filesize
64KB

Download
memory/5548-3059-0x00007FF8AD020000-0x00007FF8AD030000-memory.dmp

Filesize
64KB

Download
memory/5548-3058-0x00007FF8AD020000-0x00007FF8AD030000-memory.dmp

Filesize
64KB

Download
memory/5548-3060-0x00007FF8AD0C0000-0x00007FF8AD0CA000-memory.dmp

Filesize
40KB

Download
memory/5548-3062-0x00007FF8AB440000-0x00007FF8AB450000-memory.dmp

Filesize
64KB

Download
memory/5548-3061-0x00007FF8AB440000-0x00007FF8AB450000-memory.dmp

Filesize
64KB

Download
memory/5548-3064-0x00007FF8AB520000-0x00007FF8AB530000-memory.dmp

Filesize
64KB

Download
memory/5548-3065-0x00007FF8AB650000-0x00007FF8AB670000-memory.dmp

Filesize
128KB

Download
memory/5548-3066-0x00007FF8AB650000-0x00007FF8AB670000-memory.dmp

Filesize
128KB

Download
memory/5548-3063-0x00007FF8AB520000-0x00007FF8AB530000-memory.dmp

Filesize
64KB

Download
memory/5548-3068-0x00007FF8AB650000-0x00007FF8AB670000-memory.dmp

Filesize
128KB

Download
memory/5548-3069-0x00007FF8AB650000-0x00007FF8AB670000-memory.dmp

Filesize
128KB

Download
memory/5548-3067-0x00007FF8AB650000-0x00007FF8AB670000-memory.dmp

Filesize
128KB

Download
memory/5548-3071-0x00007FF8AC9A0000-0x00007FF8AC9B0000-memory.dmp

Filesize
64KB

Download
memory/5548-3072-0x00007FF8ACA10000-0x00007FF8ACA20000-memory.dmp

Filesize
64KB

Download
memory/5548-3073-0x00007FF8ACA10000-0x00007FF8ACA20000-memory.dmp

Filesize
64KB

Download
memory/5548-3070-0x00007FF8AC9A0000-0x00007FF8AC9B0000-memory.dmp

Filesize
64KB

Download
memory/5548-3075-0x00007FF8ACA40000-0x00007FF8ACA4E000-memory.dmp

Filesize
56KB

Download
memory/5548-3076-0x00007FF8ACA40000-0x00007FF8ACA4E000-memory.dmp

Filesize
56KB

Download
memory/5548-3074-0x00007FF8ACA40000-0x00007FF8ACA4E000-memory.dmp

Filesize
56KB

Download
memory/5548-3078-0x00007FF8AC500000-0x00007FF8AC510000-memory.dmp

Filesize
64KB

Download
memory/5548-3079-0x00007FF8AC500000-0x00007FF8AC510000-memory.dmp

Filesize
64KB

Download
memory/5548-3080-0x00007FF8AC520000-0x00007FF8AC527000-memory.dmp

Filesize
28KB

Download
memory/5548-3077-0x00007FF8AC500000-0x00007FF8AC510000-memory.dmp

Filesize
64KB

Download
memory/5548-3082-0x00007FF8AC520000-0x00007FF8AC527000-memory.dmp

Filesize
28KB

Download
memory/5548-3083-0x00007FF8AC520000-0x00007FF8AC527000-memory.dmp

Filesize
28KB

Download
memory/5548-3084-0x00007FF8AC520000-0x00007FF8AC527000-memory.dmp

Filesize
28KB

Download
memory/5548-3081-0x00007FF8AC520000-0x00007FF8AC527000-memory.dmp

Filesize
28KB

Download
memory/5548-3086-0x00007FF8AC250000-0x00007FF8AC260000-memory.dmp

Filesize
64KB

Download
memory/5548-3085-0x00007FF8AC250000-0x00007FF8AC260000-memory.dmp

Filesize
64KB

Download
memory/5548-3088-0x00007FF8AC340000-0x00007FF8AC350000-memory.dmp

Filesize
64KB

Download
memory/5548-3087-0x00007FF8AC340000-0x00007FF8AC350000-memory.dmp

Filesize
64KB

Download
memory/5548-3090-0x00007FF8AC370000-0x00007FF8AC3A0000-memory.dmp

Filesize
192KB

Download
memory/5548-3091-0x00007FF8AC370000-0x00007FF8AC3A0000-memory.dmp

Filesize
192KB

Download
memory/5548-3092-0x00007FF8AC370000-0x00007FF8AC3A0000-memory.dmp

Filesize
192KB

Download
memory/5548-3089-0x00007FF8AC370000-0x00007FF8AC3A0000-memory.dmp

Filesize
192KB

Download
memory/5548-3094-0x00007FF8AC410000-0x00007FF8AC419000-memory.dmp

Filesize
36KB

Download
memory/5548-3093-0x00007FF8AC370000-0x00007FF8AC3A0000-memory.dmp

Filesize
192KB

Download
memory/5548-3095-0x00007FF8AB690000-0x00007FF8AB6AE000-memory.dmp

Filesize
120KB

Download
memory/5548-3096-0x00007FF8AB690000-0x00007FF8AB6AE000-memory.dmp

Filesize
120KB

Download
memory/5548-3097-0x00007FF8AB690000-0x00007FF8AB6AE000-memory.dmp

Filesize
120KB

Download
memory/5548-3098-0x00007FF8AB690000-0x00007FF8AB6AE000-memory.dmp

Filesize
120KB

Download
memory/5548-3099-0x00007FF8AB690000-0x00007FF8AB6AE000-memory.dmp

Filesize
120KB

Download
memory/5548-3100-0x00007FF8AEE50000-0x00007FF8AEE51000-memory.dmp

Filesize
4KB

Download
memory/5548-3101-0x00007FF8AEED0000-0x00007FF8AEFD0000-memory.dmp

Filesize
1024KB

Download
memory/5548-3103-0x00007FF8AF010000-0x00007FF8AF030000-memory.dmp

Filesize
128KB

Download
memory/5548-3104-0x00007FF8AF010000-0x00007FF8AF030000-memory.dmp

Filesize
128KB

Download
memory/5548-3105-0x00007FF8AF010000-0x00007FF8AF030000-memory.dmp

Filesize
128KB

Download
memory/5548-3107-0x00007FF8AC260000-0x00007FF8AC340000-memory.dmp

Filesize
896KB

Download
memory/5548-3044-0x00007FF8AEEC0000-0x00007FF8AEED0000-memory.dmp

Filesize
64KB

Download
memory/5548-3125-0x000001847D670000-0x000001847D671000-memory.dmp

Filesize
4KB

Download
memory/5548-3047-0x00007FF8AF010000-0x00007FF8AF030000-memory.dmp

Filesize
128KB

Download
memory/5548-3046-0x00007FF8AF010000-0x00007FF8AF030000-memory.dmp

Filesize
128KB

Download
memory/5548-3043-0x000001847D670000-0x000001847D671000-memory.dmp

Filesize
4KB

Download